Splunk Search

map command to do stats stdev($field_name$) ...

melonman
Motivator

Hi

I am looking for a search that iterates all my fieldname start with f* and get the statistics value of each f and get the large table.

sample data looks like this:

timestamp,f1,f2,f3,f4,f5,f6,f7,f8,f9
2014/04/01 00:00:00,0,2,3,1,2,5,6,9,3
2014/04/01 00:00:01,1,0,0,1,2,3,10,1,2
...
  • there are 100+ f* fields.

Now I have the following search, which does not run successfully.

index=sampledata
| head 1 
| table f* 
| transpose 
| table column 
| rename column as f_name 
| map maxsearches=1000 search="index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"

I get this error message

Unable to run query 'index=sampledata | stats stdev(f1) as stdev | eval f_name=f1'.

I am trying to get the result that looks like this:

f_name, stdev
-------------
f1, 2
f2, 4
f3, 3
f4, 5

Anyone know how to use map command to do this?
Or anyother way to perform?

Tags (3)
0 Karma
1 Solution

linu1988
Champion

Hello,
You have missed search in the map search query.

....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"

Thanks

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

How about this?

index=sampledata | stats stdev(f*)
0 Karma

linu1988
Champion

Hello,
You have missed search in the map search query.

....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev | eval f_name=$f_name$"

Thanks

melonman
Motivator

Thank you linu1988 for pointing out!

I forgot "search"... also f_name's double quote with escape. Now my search looks like this.
(now more stats inside the map command..)

....| map maxsearches=1000 search="search index=sampledata | stats stdev($f_name$) as stdev median($f_name$) as median | eval f_name=\"$f_name$\""

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...